On Thu, Apr 21, 2016 at 11:34:14PM +0100, Dominic Hargreaves wrote: > On Thu, Apr 21, 2016 at 11:30:19PM +0200, Axel Beckert wrote: > > So either there is an according bug somewhere in diffoscope (which I > > doubt :-) for a very long time or we should also make the second build > > differ in the build directory name to catch such issues. > > > > In case the latter is already done, I'm out of ideas why that package > > counts as reproducibly buildable. > > The build path is part of the specification for the overall environment, > if I'm not mistaken - so the build is allowed to vary with changes to it. > > https://wiki.debian.org/ReproducibleBuilds/Howto > > I suppose embedding build paths is too widespread to make eliminating > that feasible, and making the build path the same is easy enough? The build path is encodeded inside ELF binaries (in some debug fields, iirc), so we can't really change it between builds, or otherwise every compiled thing would be unreproducible. There is work going on to be able to avoid having that data included in the binary at all, but that is requiring changes in gcc (dkg is taking care of this bit). For some history on why we gave up on this see https://wiki.debian.org/ReproducibleBuilds/History#Giving_up_on_build_paths (that would need to be updated to match the current WIP, though). So, yes, we are not varying the build path, and we're aware of it :) -- regards, Mattia Rizzolo GPG Key: 66AE 2B4A FCCF 3F52 DA18 4D18 4B04 3FCD B944 4540 .''`. more about me: https://mapreri.org : :' : Launchpad user: https://launchpad.net/~mapreri `. `'` Debian QA page: https://qa.debian.org/developer.php?login=mattia `-
Attachment:
signature.asc
Description: PGP signature